Privacy Policy
Version 1.0 · effective since
In case of any discrepancy, the Portuguese version prevails.
1. Who we are
Loonar Tecnologia da Informação Ltda, CNPJ 35.831.986/0001-26, headquartered at Av. Paulista, 1499 - Sala 801, Bela Vista, São Paulo – SP, CEP 01311-928, Brazil, contato@loonar.com.br. Loonar is the controller of the personal data processed on this site.
2. Data protection officer (DPO)
Our data protection officer (LGPD, art. 41) is Ricardo Montilia, reachable at privacidade@loonar.com.br or through the Data Subject Channel. Open the Data Subject Channel
3. Data we process and from whom
- Visitors: access logs and technical browsing data.
- People who contact us: identification, contact details, company, role and message.
- Job applicants: data from the submitted résumé.
- Event participants: registration data, when registration is handled by us.
- Admin panel users: access and tool usage data.
4. Purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering inquiries and preparing proposals | Form data | Pre-contractual procedures at the data subject's request (art. 7, V) and legitimate interest (art. 7, IX) | Up to 24 months without an active relationship; then anonymization |
| Sending content and invitations (opt-in) | Name, e-mail and interest | Consent (art. 7, I) | Until withdrawal |
| Hiring processes | Résumé data | Pre-contractual procedures (art. 7, V); talent pool with consent (art. 7, I) | Up to 12 months |
| Security and application access log retention | IP, date and time | Legal obligation (art. 7, II, and Brazilian Internet Act, Law 12.965/2014, art. 15) | 6 months |
| Proof of cookie consent | Consent identifier, choices and IP hash | Art. 8, §2, and regular exercise of rights (art. 7, VI) | 5 years |
| Audience measurement and third-party content | Cookies | Consent | As per the Cookie Policy |
| Handling data subject requests | Request data | Legal obligation (art. 7, II) | 5 years |
5. Sharing
We share personal data only with: processors that provide services to us (hosting, database and transactional e-mail); partner vendors, when needed for a quote, opportunity registration or licensing requested by the customer; YouTube and Google, only after your consent; and authorities, when required by law. We do not sell personal data.
Conversation channels: the site chat uses Intercom, with the Fin agent (Intercom, Inc., United States). It loads only after you consent to third-party services and receives whatever you type in the conversation. The chat may be answered by an artificial intelligence agent; when that happens, you are talking to an AI, not a person, and you can ask for a human at any time. The WhatsApp button opens a conversation on WhatsApp (WhatsApp LLC, Meta group, United States) only when you click it; from then on, WhatsApp's own policy also applies.
6. International transfer
Some processors and partner vendors keep servers outside Brazil (for example, in the United States, the European Union and Israel). Transfers take place only under one of the mechanisms of LGPD art. 33, as regulated by ANPD Resolution CD/ANPD No. 19/2024. We review our contracts with each processor so they adopt the ANPD standard contractual clauses or another valid mechanism. You can ask which safeguard applies to each processor through the Data Subject Channel.
8. Data subject rights
The LGPD (art. 18) grants you the following rights:
- Confirmation that processing exists.
- Access to your data.
- Correction of incomplete, inaccurate or outdated data.
- Anonymization, blocking or deletion of unnecessary or excessive data.
- Data portability.
- Deletion of data processed with consent.
- Information about sharing.
- Information about the option to refuse consent and its consequences.
- Withdrawal of consent.
- Objection to processing.
- Review of automated decisions (art. 20).
To exercise any right, use the Data Subject Channel or write to our DPO. We confirm receipt and provide simplified access immediately, or a full statement within 15 days (art. 19). You also have the right to petition the ANPD. Submit a request
9. Security
We adopt technical and administrative measures to protect personal data (art. 46): encryption in transit, role-based access control, database policy isolation, IP hashing, data minimization and an audit trail.
10. Security incidents
If a security incident may cause relevant risk or harm to data subjects, we will notify the ANPD and the affected subjects, as required by LGPD art. 48 and Resolution CD/ANPD No. 15/2024.
11. Retention and deletion
We keep data for the periods in the purposes table. At the end of each period, data is deleted or anonymized (LGPD arts. 15 and 16).
12. Children and teenagers
This site is not directed at people under 18, and we do not knowingly collect data from children or teenagers.
13. Automated decisions
This site makes no solely automated decisions that affect your interests.
14. Changes to this policy
We may update this policy to reflect legal or operational changes. The current version is always the one published on this page, with its effective date and the history below. Relevant changes will be highlighted on the site.
Version history
- Version 1.0 · — First published version.